A rootkit is a set of software tools frequently used by an intruder after gaining access to a computer system. These software tools are intended to conceal running processes, files or system data, which helps an intruder maintain covert or furtive access to a computer system. A rootkit is not a virus or trojan. Viruses modify a computer system file to propagate itself. Trojans masquerade as software and provide access for a hacker. Both of these techniques are susceptible to detection (see Wikipedia contributors (2006). Rootkit. Wikipedia, The Free Encyclopedia. Retrieved 06:57, Mar. 2, 2006 from http://en.wikipedia.org/w/index.php?title=Rootkit&oldid=41813778).
In contrast, a rootkit is intended to allow an intruder access to a computer system without leaving any trace. The term “kit” is used because software components work collectively to achieve the desired covertness or furtiveness. A rootkit can include additional software components for other malicious behaviour, such as “key loggers” and “packet sniffers” (see Berg, Al. The Root Of The Rootkit, SearchSecurity.com, July 2005, http://searchsecurity.techtarget.com/tip/1,289483,sid14_gci1103744,00.html).
In order to further enhance stealth capabilities of rootkits, the authors of rootkits are employing more advanced stealth methods so that normal programs that utilise operating system (Application Programming Interfaces) APIs or third party libraries are unable to detect and remove rootkits.
Rootkits are generally classified into two categories: (1) user mode (or application level mode) or (2) kernel mode. The former involves elementary binary file replacement while the latter embeds itself intricately into the operating system (see Dillard, Kurt. What Are User-Mode vs. Kernel-Mode Rootkits, SearchWindowsSecurity.com, May 2005, http://searchwindowssecurity.techtarget.com/originalContent/0,289142,sid45_gci1086469,00.html). Kernel level rootkits add additional code and/or replace a portion of kernel code with modified code to help hide a backdoor on a computer system. This is often accomplished by adding new code to the kernel via a device driver or loadable module, such as Loadable Kernel Modules in the Linux operating system or device drivers in the Windows operating system. Kernel rootkits commonly patch, hook, or replace system calls with versions that hide information about the attacker. Application level, or user mode, rootkits may replace regular application binaries with Trojan fakes, or they may modify the behaviour of existing applications using hooks, patches, injected code, or other means. Kernel rootkits can be especially dangerous because they can be difficult to detect.
There are inherent limitations to any program that attempts to detect rootkits. Rootkits are collections of programs which modify the tools or libraries upon which programs on the system depend. Some rootkits can modify the running kernel. A problem with rootkit detection is that the operating system cannot be trusted.
Filter Program:
A filter program is a program that takes control of the execution of a program, and that can monitor, redirect, alter the execution path, or forge the result. A filter program can be located anywhere between one or more programs, for example in an operating system, and a file system(s). A filter program may be part of a rootkit.
File System:
A file system is a system for organising directories and files, generally in terms of how the file system is implemented in the operating system. File systems may, but need not necessarily, use a storage device, such as a hard disk, or they may be virtual and exist only as an access method for virtual data or for data over a network. More formally, a file system is a set of abstract data types that are implemented for the storage, hierarchical organisation, manipulation, navigation, access, and retrieval of data. File systems need not make use of a storage device at all, a file system can be used to organise and represent access to any data, whether it be stored or dynamically generated (e.g., from a network connection).
Computer System:
A computer system may be a type of processing system, terminal, computer or computerised device, personal computer (PC), mobile or cellular telephone, mobile data terminal, portable computer, Personal Digital Assistant (PDA), pager or any other similar type of device. The capability of such a computer system to process, request and/or receive information or data can be provided by software, hardware and/or firmware. A computer system may include or be associated with other devices, for example a local data storage device such as a hard disk drive or solid state drive. A computer with a rootkit is sometimes called a rooted computer.
Presently, the stealth of a rootkit and the access to computer systems which can be exploited present a significant security threat to computer systems and networks.
Often rootkits are used in combination with otherwise normally detectable malware. As a result, the number of malwares (a portmanteau word of “malicious software”) that normal malware scanning software does not detect is presently increasing.
There is a need for a method, system and/or computer program which addresses or at least ameliorates problems inherent in the prior art.
The reference to any prior art in this specification is not, and should not be taken as, an acknowledgment or any form of suggestion that such prior art forms part of the common general knowledge.